Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/09/2026, 07:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe
- Size 4.0MB
- Sample260908-js2a6aea52
- SHA256 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e
- MD5 7386d504e1d311d7120876bb1ce3df44
- SHA1 7c7c083ecb64e4a91ff173328d9ef01baf3c86dd
- SHA512 8557d7634639e56e733e46ae69bf7245a56bdc95a03f5ce8028864c2cef00a41ca39351bfbd50fd8b432fd869286dfcbc2450bafbaa497d3a41ecead489cabb6
- SSDEEP 98304:XFJFsscN/91jqYJ4X6ukFSd58b8jFCBgp+nMSNlnB6Woj9ghi1RebMIg9Cbk/V8l:/yqpo0d58bGeMSNlnB6WojDIg9Cbk/Vw
- TLSH T1C4168DE17F5D8067C163253189F9AE78B6FAAD60FA35024731503A3EFB317C2592861B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
fatalrat
C2
-
http://www.taobao.com/help/getip.php
-
https://vv.video.qq.com/checktime?otype=ojson
-
https://searchplugin.csdn.net/api/v1/ip/get?ip=
-
https://www.ipplus360.com/getIP
Signatures
- Fatal Rat payload 1 IoCs
resource yara_rule behavioral1/memory/2984-18-0x0000000000890000-0x00000000008B9000-memory.dmp fatalrat - Executes dropped EXE 3 IoCs
pid Process 2984 DropboxCrashHandler.exe 2568 DropboxCrashHandler.exe 2100 SysUtilSvc.exe - Loads dropped DLL 2 IoCs
pid Process 2984 DropboxCrashHandler.exe 2568 DropboxCrashHandler.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUtility = "C:\\Windows\\SysUtilSvc.exe" 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSys8523 = "C:\\Program Files (x86)\\Dropbox\\Update\\1.3.5055.162\\DropboxCrashHandler.exe" DropboxCrashHandler.exe - Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.png 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe SysUtilSvc.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll SysUtilSvc.exe File opened for modification C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.png SysUtilSvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\SysUtilSvc.exe 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe File opened for modification C:\Windows\SysUtilSvc.exe 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SysUtilSvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DropboxCrashHandler.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz DropboxCrashHandler.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe 2984 DropboxCrashHandler.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2984 DropboxCrashHandler.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3088 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe 3088 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe 2100 SysUtilSvc.exe 2100 SysUtilSvc.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3088 wrote to memory of 2984 3088 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe"C:\Users\Admin\AppData\Local\Temp\7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2568
-
C:\Windows\SysUtilSvc.exeC:\Windows\SysUtilSvc.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe
- Size 130KB
- SHA256 e7141aeb22ea3165a4f7fb8c4d210151575f1b95ef545e0978a2174598a08265
- MD5 3b607e9ae169797c5112736dd445db25
- SHA1 076e59938996baf436888e2ecb536353071e0adf
- SHA512 1a80b6ed790d3325c365de14d7bdd4d98473c2cfd8a4eb5d97f99d9383946e6c9e892820e54182b06359f495cc42f261e455e3097413c605f0f208d7b6e3c2cd
- SSDEEP 3072:BZOOxLE4GTnrcyG2QltfW/ggXi0+LStLnh5jAm7tJOX47cIA9:iOxLEbTtwLf
- TLSH T10CD3C5C1F5B84CB9F4F35A395429867285BFB83DF922864E2A94015D0E23DC38E257E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.PNG
- Size 195KB
- SHA256 a9ea7566f183454d25ff53b6fc20d2fde9353ff37f78fd8757fb9d8f4f33d1cb
- MD5 714172a59ff9e26309229af1e725dd8a
- SHA1 d48f282a2be200165ffc3eab4bd47bf5906bfca1
- SHA512 f29feaa3683f88304798b79e343835069264ae5476aa9bdb4e3b8d3555a939cb5f46156ff1218b627b88fa6d6e9239ea6899d52129182717e245df4d67e709b5
- SSDEEP 3072:jDX38Jo4uaXUP/l4n5aNZtFhM4BpYMMIJ:jz8DuaEGniXF7
- TLSH T19414BE8D2EF00DCD1DF029D09D59866303ACCDA5F487B85CC99BFB86993374929D6A32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll
- Size 42KB
- SHA256 a7d07b13f6fc72ff905c69579f9be0cec237fc6df97b0d24e51ba44129831caa
- MD5 511e3fa6ba5f836db6abb2504b7c33ab
- SHA1 57167190667384d66baf9031dcddd917970e7e15
- SHA512 59f568ee6edad89720c4a83e7580a16149c6e81059f71509e8765e30e9098827b40be0ee94ac0b130ede687eb53e81807ca42b48ffd55af67daac18f3c9f9829
- SSDEEP 768:EKMh1TbnaCdR5LdcRzSW8PHTiyrk1n9oMRCUH:wTLdRN6Z8PLCn3RCU
- TLSH T1C2135B107540D073C14A6538A05ADBA18E6E7A111BF1A187BFBB1B7E9F712E0A73E347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
- Size 471B
- SHA256 85669d3ad083f83756d1d39836377449bb3d0ef2c4e28ca9a7aabba4f5242842
- MD5 c32ba398301dc0786ddd50b5c854b7d6
- SHA1 2ffb6377f1b848d6c0c5b8b573d8e468f3d8a96c
- SHA512 cb3548b48a84eb74208eb7f1ba775edbae6c631688923d0beacbe220f5d6ced8c9b0e082ee241c35c2449c2406d20f8847d97fb9014c280ecfe9b4c08029f0d4
- TLSH T1EFF0DC01107238D51E0B0F0C3CF29D357022116E6A66A1FEBB79DA894721BA8B917090
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_7F584189DFCC61AA971930CA5AED3120
- Size 471B
- SHA256 00386136825b0e719dd55b659691b90f264c7d271a0cdd9e7e6d21eb421e0c1b
- MD5 9e64e6db5b1efb6ba0946f9769523fc6
- SHA1 6025daa38e7db88ac6098487d90f9b659ddf5246
- SHA512 10b4a09303a6c991be5a1b096aa88a185631f8b32cc3a78f8d4f9321c64b7deeea808d57b0fe405e050dbfc595ffbec843d166aba71cb52269560d4def3622c0
- TLSH T162F0D441D8DEF153355404FC10D1663BBC31622B56C004A6B03C4992469965DFD5F136
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
- Size 402B
- SHA256 55117fcb774033ccde31d68f6b7d0361cf837617f15f1e2ace580d29819703b4
- MD5 4881950ce331ec6f5bf5c56ab335075a
- SHA1 d2b1f16feb6f8b474c093e39c74aa7b7486d638f
- SHA512 42046972519fa988a7ab4e9594e9a696eab0ee576ecd1868f3803944f6f0147f38501b7b86fbb51d194673bcb5d1095c6fa8e635189cc9617ad42bda5b5d65d4
- TLSH T127E0C02409FE627CF0B5DA704BCAA521081BF1049F54D26916D00319AB0F500DC32D38
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_7F584189DFCC61AA971930CA5AED3120
- Size 412B
- SHA256 89fa5509876a2d59e364052ed31a5be9e826e21037eeac16100713a5d4f383d6
- MD5 31f5367109286719bf58bcfd6da1b0d2
- SHA1 7402aedda113208dbe65cf53a11b39e060080ec5
- SHA512 5f48f9c80e4c9108d15c6a58f641d40b9a01f27a47de94f767b6dcde0073075ad73dfac7e07290927957faad989b643a07be474fddda5360f9e77755b0ec1646
- TLSH T120E0C02811FB411CF9E4E4350BC9B174596AF0214645F2B11AD02709A706D00DC51D35
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysUtilSvc.exe
- Size 4.0MB
- SHA256 7a5a4f8d21d7e1482a6530d7399ac934d1e756965059e3f6339c560042f23c1e
- MD5 7386d504e1d311d7120876bb1ce3df44
- SHA1 7c7c083ecb64e4a91ff173328d9ef01baf3c86dd
- SHA512 8557d7634639e56e733e46ae69bf7245a56bdc95a03f5ce8028864c2cef00a41ca39351bfbd50fd8b432fd869286dfcbc2450bafbaa497d3a41ecead489cabb6
- SSDEEP 98304:XFJFsscN/91jqYJ4X6ukFSd58b8jFCBgp+nMSNlnB6Woj9ghi1RebMIg9Cbk/V8l:/yqpo0d58bGeMSNlnB6WojDIg9Cbk/Vw
- TLSH T1C4168DE17F5D8067C163253189F9AE78B6FAAD60FA35024731503A3EFB317C2592861B
- MD5 SHA1 SHA512 SSDEEP TLSH